Analysis
- max time kernel
154s - max time network
44s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
11/10/2022, 10:42
General
- Target PO-EP3141802303 -42804009_83276378283989393872376532893293009783763.exe
- Size 819KB
- Sample221011-mrnv8aagdn
- SHA256 7c9e88afcdeebca3c1f07c6a2c571d2fd51260c6dba7fdf0d2d10999ba23836d
Malware Config
Signatures
- Loads dropped DLL 23 IoCs
- Drops file in Program Files directory 3 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO-EP3141802303 -42804009_83276378283989393872376532893293009783763.exe"C:\Users\Admin\AppData\Local\Temp\PO-EP3141802303 -42804009_83276378283989393872376532893293009783763.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe 0x6B6570CB -bxor 6772⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe 0x656C3197 -bxor 6772⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe 0x3A3A41D7 -bxor 6772⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe 0x656176C0 -bxor 6772⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe 0x46696EC0 -bxor 6772⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe 0x41286F85 -bxor 6772⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe 0x72342289 -bxor 6772⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe 0x20692295 -bxor 6772⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe 0x78383295 -bxor 6772⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe 0x30303295 -bxor 6772⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe 0x302C22CC -bxor 6772⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe 0x20302E85 -bxor 6772⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe 0x70203289 -bxor 6772⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe 0x20692291 -bxor 6772⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe 0x2C206B85 -bxor 6772⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe 0x30783A95 -bxor 6772⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe 0x2C206B85 -bxor 6772⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe 0x30296B8B -bxor 6772⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe 0x723322FC -bxor 6772⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe 0x6B6570CB -bxor 6772⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe 0x656C3197 -bxor 6772⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe 0x3A3A54CC -bxor 6772⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe 0x727477C4 -bxor 6772⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
d93f411851d7c929.customDestinations-ms
d93f411851d7c929.customDestinations-ms
d93f411851d7c929.customDestinations-ms
d93f411851d7c929.customDestinations-ms
d93f411851d7c929.customDestinations-ms
d93f411851d7c929.customDestinations-ms
d93f411851d7c929.customDestinations-ms
d93f411851d7c929.customDestinations-ms
d93f411851d7c929.customDestinations-ms
d93f411851d7c929.customDestinations-ms
d93f411851d7c929.customDestinations-ms
d93f411851d7c929.customDestinations-ms
d93f411851d7c929.customDestinations-ms
d93f411851d7c929.customDestinations-ms
d93f411851d7c929.customDestinations-ms
d93f411851d7c929.customDestinations-ms
d93f411851d7c929.customDestinations-ms
d93f411851d7c929.customDestinations-ms
d93f411851d7c929.customDestinations-ms
d93f411851d7c929.customDestinations-ms
nsExec.dll
nsExec.dll
nsExec.dll
nsExec.dll
nsExec.dll
nsExec.dll
nsExec.dll
nsExec.dll
nsExec.dll
nsExec.dll
nsExec.dll
nsExec.dll
nsExec.dll
nsExec.dll
nsExec.dll
nsExec.dll
nsExec.dll
nsExec.dll
nsExec.dll
nsExec.dll
nsExec.dll
nsExec.dll
nsExec.dll
memory/304-110-0x0000000073600000-0x0000000073BAB000-memory.dmp
memory/844-148-0x0000000073600000-0x0000000073BAB000-memory.dmp
memory/976-92-0x00000000735E0000-0x0000000073B8B000-memory.dmp
memory/976-93-0x00000000735E0000-0x0000000073B8B000-memory.dmp
memory/1040-131-0x0000000073600000-0x0000000073BAB000-memory.dmp
memory/1056-81-0x00000000735E0000-0x0000000073B8B000-memory.dmp
memory/1084-158-0x0000000073600000-0x0000000073BAB000-memory.dmp
memory/1084-159-0x0000000073600000-0x0000000073BAB000-memory.dmp
memory/1200-126-0x00000000735E0000-0x0000000073B8B000-memory.dmp
memory/1252-70-0x00000000735E0000-0x0000000073B8B000-memory.dmp
memory/1252-121-0x0000000073600000-0x0000000073BAB000-memory.dmp
memory/1252-120-0x0000000073600000-0x0000000073BAB000-memory.dmp
memory/1252-69-0x00000000735E0000-0x0000000073B8B000-memory.dmp
memory/1280-153-0x00000000735E0000-0x0000000073B8B000-memory.dmp
memory/1476-54-0x0000000074C11000-0x0000000074C13000-memory.dmp
memory/1480-59-0x0000000073630000-0x0000000073BDB000-memory.dmp
memory/1480-58-0x0000000073630000-0x0000000073BDB000-memory.dmp
memory/1540-174-0x00000000735E0000-0x0000000073B8B000-memory.dmp
memory/1588-115-0x00000000735E0000-0x0000000073B8B000-memory.dmp
memory/1592-99-0x0000000073600000-0x0000000073BAB000-memory.dmp
memory/1608-143-0x00000000735E0000-0x0000000073B8B000-memory.dmp
memory/1608-142-0x00000000735E0000-0x0000000073B8B000-memory.dmp
memory/1728-136-0x00000000735E0000-0x0000000073B8B000-memory.dmp
memory/1728-87-0x0000000073600000-0x0000000073BAB000-memory.dmp
memory/1740-76-0x0000000073600000-0x0000000073BAB000-memory.dmp
memory/1928-64-0x00000000735F0000-0x0000000073B9B000-memory.dmp
memory/1968-169-0x0000000073600000-0x0000000073BAB000-memory.dmp
memory/2004-164-0x00000000735E0000-0x0000000073B8B000-memory.dmp
memory/2036-104-0x00000000735E0000-0x0000000073B8B000-memory.dmp